skillwiki 0.10.100 → 0.10.102

package/dist/{chunk-3QT3OFAL.js → chunk-PIXBNB74.js}

@@ -40,7 +40,7 @@ import {
   snapshotterAliasForLocalHost,
   toUndirectedWeighted,
   writeDotenv
-} from "./chunk-B4QTKCEK.js";
+} from "./chunk-7UK67FAZ.js";
 import {
   atomicWriteText,
   prepareTypedPage
@@ -1018,6 +1018,10 @@ import { join as join5 } from "path";
 function validateKey(key) {
   return CONFIG_KEYS.includes(key) || isValidWikiProfileKey(key) || isVaultSyncKey(key);
 }
+function displayConfigValue(key, value) {
+  if (key === "SKILLWIKI_MCP_TOKEN") return value.length > 0 ? "TOKEN_SET" : "";
+  return value;
+}
 function configPath(home) {
   return join5(home, ".skillwiki", ".env");
 }
@@ -1056,7 +1060,10 @@ async function runConfigSet(input) {
 }
 async function runConfigList(input) {
   const map = await parseDotenvFile(configPath(input.home));
-  const entries = Object.entries(map).map(([key, value]) => ({ key, value: value ?? "" }));
+  const entries = Object.entries(map).map(([key, value]) => ({
+    key,
+    value: displayConfigValue(key, value ?? "")
+  }));
   let profiles;
   if (input.profiles) {
     const defaultProfile = map["WIKI_DEFAULT"];
@@ -1078,23 +1085,66 @@ async function runConfigPath(input) {
   return { exitCode: ExitCode.OK, result: ok({ path: filePath, exists: existsSync2(filePath), humanHint: filePath }) };
 }
 
+// src/utils/mcp-auth-env.ts
+import { join as join6 } from "path";
+var MCP_URL_ENV = "SKILLWIKI_MCP_URL";
+var MCP_TOKEN_ENV = "SKILLWIKI_MCP_TOKEN";
+var MCP_HOST_ID_ENV = "SKILLWIKI_HOST_ID";
+function nonEmptyEnvValue(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function mcpAuthFromEnv(env) {
+  return {
+    url: nonEmptyEnvValue(env[MCP_URL_ENV]),
+    token: nonEmptyEnvValue(env[MCP_TOKEN_ENV]),
+    hostId: nonEmptyEnvValue(env[MCP_HOST_ID_ENV])
+  };
+}
+async function resolveMcpAuthEnv(input) {
+  const processAuth = mcpAuthFromEnv(input.env ?? process.env);
+  const dotenv = await parseDotenvFile(join6(input.home, ".skillwiki", ".env"));
+  const fileAuth = mcpAuthFromEnv(dotenv);
+  return {
+    url: processAuth.url ?? fileAuth.url,
+    token: processAuth.token ?? fileAuth.token,
+    hostId: processAuth.hostId ?? fileAuth.hostId
+  };
+}
+async function mergeMcpAuthIntoEnv(home, env) {
+  const auth = await resolveMcpAuthEnv({ home, env });
+  const merged = { ...env };
+  if (auth.url && !nonEmptyEnvValue(env[MCP_URL_ENV])) merged[MCP_URL_ENV] = auth.url;
+  if (auth.token && !nonEmptyEnvValue(env[MCP_TOKEN_ENV])) merged[MCP_TOKEN_ENV] = auth.token;
+  if (auth.hostId && !nonEmptyEnvValue(env[MCP_HOST_ID_ENV])) merged[MCP_HOST_ID_ENV] = auth.hostId;
+  return merged;
+}
+function redactMcpSecret(text, secret) {
+  if (!secret || secret.length === 0 || !text.includes(secret)) return text;
+  return text.split(secret).join("[REDACTED]");
+}
+function isMcpOnlyLeaf(input) {
+  return !input.resolvedPath && Boolean(input.token) && !input.vaultSyncInstalled;
+}
+
 // src/doctor/runner.ts
 import { existsSync as existsSync18 } from "fs";
 
 // src/doctor/probes/environment.ts
 import { existsSync as existsSync4, lstatSync, readlinkSync } from "fs";
-import { resolve as resolve2, join as join7 } from "path";
+import { resolve as resolve2, join as join8 } from "path";
 import { execSync } from "child_process";
 
 // src/utils/plugin-registry.ts
 import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync2 } from "fs";
-import { join as join6 } from "path";
-var REGISTRY_PATH = join6(".claude", "plugins", "installed_plugins.json");
-var CODEX_CONFIG_PATH = join6(".codex", "config.toml");
+import { join as join7 } from "path";
+var REGISTRY_PATH = join7(".claude", "plugins", "installed_plugins.json");
+var CODEX_CONFIG_PATH = join7(".codex", "config.toml");
 var PLUGIN_KEY = "skillwiki@llm-wiki";
 function readInstalledPlugins(home) {
   try {
-    const raw = readFileSync2(join6(home, REGISTRY_PATH), "utf8");
+    const raw = readFileSync2(join7(home, REGISTRY_PATH), "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -1130,7 +1180,7 @@ function findPluginInstallations(home, key = PLUGIN_KEY) {
   return installs;
 }
 function findGrokPlugin(home, key, pluginName, marketplace) {
-  const pluginsRoot = join6(home, ".grok", "installed-plugins");
+  const pluginsRoot = join7(home, ".grok", "installed-plugins");
   if (!existsSync3(pluginsRoot)) return null;
   let entries;
   try {
@@ -1141,10 +1191,10 @@ function findGrokPlugin(home, key, pluginName, marketplace) {
   let best = null;
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const installPath = join6(pluginsRoot, entry.name);
+    const installPath = join7(pluginsRoot, entry.name);
     let manifest;
     try {
-      manifest = JSON.parse(readFileSync2(join6(installPath, ".claude-plugin", "plugin.json"), "utf8"));
+      manifest = JSON.parse(readFileSync2(join7(installPath, ".claude-plugin", "plugin.json"), "utf8"));
     } catch {
       continue;
     }
@@ -1168,7 +1218,7 @@ function findGrokPlugin(home, key, pluginName, marketplace) {
 function findCodexPlugin(home, key, pluginName, marketplace) {
   const config = readCodexPluginConfig(home, key, marketplace);
   if (!config?.enabled) return null;
-  const cacheRoot = join6(home, ".codex", "plugins", "cache", marketplace, pluginName);
+  const cacheRoot = join7(home, ".codex", "plugins", "cache", marketplace, pluginName);
   if (!existsSync3(cacheRoot)) return null;
   let versions;
   try {
@@ -1184,7 +1234,7 @@ function findCodexPlugin(home, key, pluginName, marketplace) {
     key,
     pluginName,
     marketplace,
-    installPath: join6(cacheRoot, version),
+    installPath: join7(cacheRoot, version),
     version,
     sourceType: config.sourceType,
     source: config.source
@@ -1201,7 +1251,7 @@ function parsePluginKey(key) {
 function readCodexPluginConfig(home, key, marketplace) {
   let raw;
   try {
-    raw = readFileSync2(join6(home, CODEX_CONFIG_PATH), "utf8");
+    raw = readFileSync2(join7(home, CODEX_CONFIG_PATH), "utf8");
   } catch {
     return null;
   }
@@ -1243,9 +1293,14 @@ function parseTomlScalar(rawValue) {
 }
 
 // src/doctor/probes/helpers.ts
+var MCP_ONLY_LEAF_SKIP = "MCP-only leaf \u2014 check skipped";
 function check(status, id, label, detail) {
   return { id, label, status, detail };
 }
+function mcpOnlyOr(mcpOnlyLeaf, id, label, fallback) {
+  if (mcpOnlyLeaf) return check("info", id, label, MCP_ONLY_LEAF_SKIP);
+  return fallback;
+}
 
 // src/doctor/probes/environment.ts
 function checkNodeVersion() {
@@ -1273,12 +1328,12 @@ function detectCliChannels(argv, home) {
   }
   const plugin = findPlugin(home);
   if (plugin) {
-    const pluginBin = join7(plugin.installPath, "bin", "skillwiki");
+    const pluginBin = join8(plugin.installPath, "bin", "skillwiki");
     if (existsSync4(pluginBin)) {
       channels.push({ name: "plugin", path: pluginBin, isDevLink: false });
     }
   }
-  const installBin = join7(home, ".claude", "skills", "bin", "skillwiki");
+  const installBin = join8(home, ".claude", "skills", "bin", "skillwiki");
   if (existsSync4(installBin)) {
     channels.push({ name: "install", path: installBin, isDevLink: false });
   }
@@ -1370,7 +1425,7 @@ async function checkProfiles(home) {
 }
 async function checkProjectLocalOverride(cwd) {
   const dir = cwd ?? process.cwd();
-  const envPath = join7(dir, ".skillwiki", ".env");
+  const envPath = join8(dir, ".skillwiki", ".env");
   if (existsSync4(envPath)) {
     return check("pass", "project_local", "Project-local config", `Found: ${envPath}`);
   }
@@ -1380,6 +1435,14 @@ function checkWikiPathSet(ctx) {
   if (ctx.resolvedPath) {
     return check("pass", "wiki_path_set", "WIKI_PATH configured", `Resolved via ${ctx.wikiPathSource ?? "unknown"}: ${ctx.resolvedPath}`);
   }
+  if (ctx.mcpOnlyLeaf) {
+    return check(
+      "info",
+      "wiki_path_set",
+      "WIKI_PATH configured",
+      "MCP-only leaf \u2014 no local vault; HTTP MCP handshake is the success gate"
+    );
+  }
   return check("error", "wiki_path_set", "WIKI_PATH configured", "No vault configured. Run `skillwiki init` or pass --vault.");
 }
 var environmentProbe = {
@@ -1398,41 +1461,56 @@ var environmentProbe = {
 
 // src/doctor/probes/vault-structure.ts
 import { existsSync as existsSync5, statSync as statSync2 } from "fs";
-import { join as join8 } from "path";
-function checkWikiPathExists(resolvedPath) {
+import { join as join9 } from "path";
+function checkWikiPathExists(resolvedPath, mcpOnlyLeaf) {
   if (resolvedPath === void 0) {
-    return check("error", "wiki_path_exists", "Vault directory exists", "Cannot check \u2014 WIKI_PATH not resolved");
+    return mcpOnlyOr(
+      mcpOnlyLeaf,
+      "wiki_path_exists",
+      "Vault directory exists",
+      check("error", "wiki_path_exists", "Vault directory exists", "Cannot check \u2014 WIKI_PATH not resolved")
+    );
   }
   if (existsSync5(resolvedPath) && statSync2(resolvedPath).isDirectory()) {
     return check("pass", "wiki_path_exists", "Vault directory exists", resolvedPath);
   }
   return check("error", "wiki_path_exists", "Vault directory exists", `${resolvedPath} does not exist or is not a directory`);
 }
-function checkVaultStructure(resolvedPath) {
+function checkVaultStructure(resolvedPath, mcpOnlyLeaf) {
   if (resolvedPath === void 0) {
-    return check("error", "vault_structure", "Vault structure valid", "Cannot check \u2014 WIKI_PATH not resolved");
+    return mcpOnlyOr(
+      mcpOnlyLeaf,
+      "vault_structure",
+      "Vault structure valid",
+      check("error", "vault_structure", "Vault structure valid", "Cannot check \u2014 WIKI_PATH not resolved")
+    );
   }
   if (!existsSync5(resolvedPath)) {
     return check("error", "vault_structure", "Vault structure valid", "Cannot check \u2014 vault directory does not exist");
   }
   const missing = [];
-  if (!existsSync5(join8(resolvedPath, "SCHEMA.md"))) missing.push("SCHEMA.md");
+  if (!existsSync5(join9(resolvedPath, "SCHEMA.md"))) missing.push("SCHEMA.md");
   for (const dir of ["raw", "entities", "concepts", "meta"]) {
-    if (!existsSync5(join8(resolvedPath, dir))) missing.push(dir + "/");
+    if (!existsSync5(join9(resolvedPath, dir))) missing.push(dir + "/");
   }
   if (missing.length === 0) {
     return check("pass", "vault_structure", "Vault structure valid", "All required files and directories present");
   }
   return check("warn", "vault_structure", "Vault structure valid", `Missing: ${missing.join(", ")} \u2014 run \`skillwiki init\` to add CodeWiki structure`);
 }
-function checkObsidianTemplates(resolvedPath) {
+function checkObsidianTemplates(resolvedPath, mcpOnlyLeaf) {
   if (resolvedPath === void 0) {
-    return check("error", "obsidian_templates", "Obsidian templates", "Cannot check \u2014 WIKI_PATH not resolved");
+    return mcpOnlyOr(
+      mcpOnlyLeaf,
+      "obsidian_templates",
+      "Obsidian templates",
+      check("error", "obsidian_templates", "Obsidian templates", "Cannot check \u2014 WIKI_PATH not resolved")
+    );
   }
   const missing = [];
-  if (!existsSync5(join8(resolvedPath, "_Templates"))) missing.push("_Templates/");
-  if (!existsSync5(join8(resolvedPath, ".obsidian", "templates.json"))) missing.push(".obsidian/templates.json");
-  if (!existsSync5(join8(resolvedPath, ".obsidian", "app.json"))) missing.push(".obsidian/app.json");
+  if (!existsSync5(join9(resolvedPath, "_Templates"))) missing.push("_Templates/");
+  if (!existsSync5(join9(resolvedPath, ".obsidian", "templates.json"))) missing.push(".obsidian/templates.json");
+  if (!existsSync5(join9(resolvedPath, ".obsidian", "app.json"))) missing.push(".obsidian/app.json");
   if (missing.length === 0) {
     return check("pass", "obsidian_templates", "Obsidian templates", "Template folder and config present");
   }
@@ -1442,23 +1520,28 @@ var vaultStructureProbe = {
   id: "vault_structure",
   run(ctx) {
     return [
-      checkWikiPathExists(ctx.resolvedPath),
-      checkVaultStructure(ctx.resolvedPath),
-      checkObsidianTemplates(ctx.resolvedPath)
+      checkWikiPathExists(ctx.resolvedPath, ctx.mcpOnlyLeaf),
+      checkVaultStructure(ctx.resolvedPath, ctx.mcpOnlyLeaf),
+      checkObsidianTemplates(ctx.resolvedPath, ctx.mcpOnlyLeaf)
     ];
   }
 };
 
 // src/doctor/probes/git-fleet.ts
 import { existsSync as existsSync6, readFileSync as readFileSync3 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 import { execSync as execSync2 } from "child_process";
 import { platform } from "os";
-function checkVaultGitRemote(resolvedPath) {
+function checkVaultGitRemote(resolvedPath, mcpOnlyLeaf = false) {
   if (resolvedPath === void 0) {
-    return check("error", "vault_git_remote", "Vault git remote", "Cannot check \u2014 WIKI_PATH not resolved");
+    return mcpOnlyOr(
+      mcpOnlyLeaf,
+      "vault_git_remote",
+      "Vault git remote",
+      check("error", "vault_git_remote", "Vault git remote", "Cannot check \u2014 WIKI_PATH not resolved")
+    );
   }
-  if (!existsSync6(join9(resolvedPath, ".git"))) {
+  if (!existsSync6(join10(resolvedPath, ".git"))) {
     return check("warn", "vault_git_remote", "Vault git remote", "Vault is not a git repository \u2014 sync features unavailable");
   }
   try {
@@ -1497,11 +1580,16 @@ async function checkFleetIdentity(input) {
   const detail = load.warnings.length > 0 ? load.warnings.join("; ") : "Fleet identity is unresolved";
   return check("warn", "fleet_identity", "Fleet identity", detail);
 }
-function checkSyncLastPush(resolvedPath) {
+function checkSyncLastPush(resolvedPath, mcpOnlyLeaf = false) {
   if (resolvedPath === void 0) {
-    return check("error", "sync_last_push", "Vault sync recency", "Cannot check \u2014 WIKI_PATH not resolved");
+    return mcpOnlyOr(
+      mcpOnlyLeaf,
+      "sync_last_push",
+      "Vault sync recency",
+      check("error", "sync_last_push", "Vault sync recency", "Cannot check \u2014 WIKI_PATH not resolved")
+    );
   }
-  if (!existsSync6(join9(resolvedPath, ".git"))) {
+  if (!existsSync6(join10(resolvedPath, ".git"))) {
     return check("pass", "sync_last_push", "Vault sync recency", "No git repo \u2014 sync check skipped");
   }
   let timestamp;
@@ -1550,7 +1638,7 @@ function checkVaultGitDirty(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("pass", "vault_git_dirty", "Vault git dirty state", "No vault path \u2014 check skipped");
   }
-  if (!existsSync6(join9(resolvedPath, ".git"))) {
+  if (!existsSync6(join10(resolvedPath, ".git"))) {
     return check("pass", "vault_git_dirty", "Vault git dirty state", "No git repo \u2014 check skipped");
   }
   try {
@@ -1597,7 +1685,7 @@ function remoteMainHash(resolvedPath) {
 }
 function checkStaleRemoteMain(resolvedPath) {
   if (resolvedPath === void 0) return void 0;
-  if (!existsSync6(join9(resolvedPath, ".git"))) return void 0;
+  if (!existsSync6(join10(resolvedPath, ".git"))) return void 0;
   const localOrigin = gitRefHash(resolvedPath, "origin/main");
   if (!localOrigin) return void 0;
   const remoteMain = remoteMainHash(resolvedPath);
@@ -1613,7 +1701,7 @@ function checkVaultGitComparison(resolvedPath, id, label, range, nonZeroSuffix,
   if (resolvedPath === void 0) {
     return check("pass", id, label, "No vault path \u2014 check skipped");
   }
-  if (!existsSync6(join9(resolvedPath, ".git"))) {
+  if (!existsSync6(join10(resolvedPath, ".git"))) {
     return check("pass", id, label, "No git repo \u2014 check skipped");
   }
   if (!hasOriginMain(resolvedPath)) {
@@ -1658,11 +1746,11 @@ function checkVaultGitBehind(resolvedPath) {
 }
 function pullLogPaths(home) {
   const paths = platform() === "darwin" ? [
-    join9(home, "Library", "Logs", "wiki-pull.log"),
-    join9(home, ".local", "state", "vault-sync", "log", "wiki-pull.log")
+    join10(home, "Library", "Logs", "wiki-pull.log"),
+    join10(home, ".local", "state", "vault-sync", "log", "wiki-pull.log")
   ] : [
-    join9(home, ".local", "state", "vault-sync", "log", "wiki-pull.log"),
-    join9(home, "Library", "Logs", "wiki-pull.log")
+    join10(home, ".local", "state", "vault-sync", "log", "wiki-pull.log"),
+    join10(home, "Library", "Logs", "wiki-pull.log")
   ];
   return [...new Set(paths)];
 }
@@ -1693,11 +1781,16 @@ function checkVaultGitPullFailures(home) {
     return check("warn", "vault_git_pull_failures", "Vault pull failures", `Could not read ${path}`);
   }
 }
-function checkVaultLocalGit(resolvedPath) {
+function checkVaultLocalGit(resolvedPath, mcpOnlyLeaf = false) {
   if (resolvedPath === void 0) {
-    return check("warn", "vault_local_git", "Vault local git", "Cannot check \u2014 WIKI_PATH not resolved");
+    return mcpOnlyOr(
+      mcpOnlyLeaf,
+      "vault_local_git",
+      "Vault local git",
+      check("warn", "vault_local_git", "Vault local git", "Cannot check \u2014 WIKI_PATH not resolved")
+    );
   }
-  if (!existsSync6(join9(resolvedPath, ".git"))) {
+  if (!existsSync6(join10(resolvedPath, ".git"))) {
     return check("warn", "vault_local_git", "Vault local git", "Not a git repository - sync features unavailable");
   }
   try {
@@ -1716,7 +1809,7 @@ function checkVaultGithubRemote(resolvedPath, exec) {
   if (resolvedPath === void 0) {
     return check("pass", "vault_github_remote", "Vault GitHub remote", "No vault path \u2014 check skipped");
   }
-  if (!existsSync6(join9(resolvedPath, ".git"))) {
+  if (!existsSync6(join10(resolvedPath, ".git"))) {
     return check("pass", "vault_github_remote", "Vault GitHub remote", "No git repo \u2014 check skipped");
   }
   const state = probeGithubReachability(resolvedPath, exec);
@@ -1760,7 +1853,7 @@ function checkVaultPromotionLag(resolvedPath) {
   if (resolvedPath === void 0) {
     return check("pass", "vault_promotion_lag", "Vault promotion lag", "No vault path \u2014 check skipped");
   }
-  if (!existsSync6(join9(resolvedPath, ".git"))) {
+  if (!existsSync6(join10(resolvedPath, ".git"))) {
     return check("pass", "vault_promotion_lag", "Vault promotion lag", "No git repo \u2014 check skipped");
   }
   try {
@@ -1787,7 +1880,7 @@ var gitFleetProbe = {
   id: "git_fleet",
   async run(ctx) {
     return [
-      checkVaultGitRemote(ctx.gitCheckPath),
+      checkVaultGitRemote(ctx.gitCheckPath, ctx.mcpOnlyLeaf),
       await checkFleetIdentity({
         vaultPath: ctx.resolvedPath,
         home: ctx.input.home,
@@ -1795,12 +1888,12 @@ var gitFleetProbe = {
         envValue: ctx.input.envValue,
         fleetLoad: ctx.fleetLoad
       }),
-      checkSyncLastPush(ctx.gitCheckPath),
+      checkSyncLastPush(ctx.gitCheckPath, ctx.mcpOnlyLeaf),
       checkVaultGitDirty(ctx.gitCheckPath),
       checkVaultGitAhead(ctx.gitCheckPath),
       checkVaultGitBehind(ctx.gitCheckPath),
       checkVaultGitPullFailures(ctx.input.home),
-      checkVaultLocalGit(ctx.gitCheckPath),
+      checkVaultLocalGit(ctx.gitCheckPath, ctx.mcpOnlyLeaf),
       checkVaultGithubRemote(ctx.gitCheckPath, ctx.input.execProbe),
       checkVaultS3Remote(ctx.input.home, ctx.input.execProbe, ctx.input.env ?? process.env),
       checkVaultSnapshotterReachable(ctx.fleetLoad, ctx.input.checkSnapshotter, ctx.input.execProbe),
@@ -1811,11 +1904,11 @@ var gitFleetProbe = {
 
 // src/doctor/probes/hygiene.ts
 import { existsSync as existsSync8, readdirSync as readdirSync3, readFileSync as readFileSync5 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 
 // src/utils/conflict-markers.ts
 import { existsSync as existsSync7, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 function scanConflictMarkerBlocksInText(relPath, text) {
   const findings = [];
   const lines = text.split(/\r?\n/);
@@ -1866,7 +1959,7 @@ function walkMarkdownFiles(root, dir, rel, out) {
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (PRUNE_DIRS.has(entry.name)) continue;
-      walkMarkdownFiles(root, join10(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name, out);
+      walkMarkdownFiles(root, join11(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name, out);
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
       out.push(rel ? `${rel}/${entry.name}` : entry.name);
     }
@@ -1880,7 +1973,7 @@ function scanVaultConflictMarkers(vaultRoot) {
   for (const rel of relPaths) {
     let text;
     try {
-      text = readFileSync4(join10(vaultRoot, rel), "utf8");
+      text = readFileSync4(join11(vaultRoot, rel), "utf8");
     } catch {
       continue;
     }
@@ -1890,11 +1983,16 @@ function scanVaultConflictMarkers(vaultRoot) {
 }
 
 // src/doctor/probes/hygiene.ts
-function checkDotStoreClean(resolvedPath) {
+function checkDotStoreClean(resolvedPath, mcpOnlyLeaf = false) {
   if (resolvedPath === void 0) {
-    return check("error", "dsstore_clean", "No .DS_Store in raw/", "Cannot check \u2014 WIKI_PATH not resolved");
+    return mcpOnlyOr(
+      mcpOnlyLeaf,
+      "dsstore_clean",
+      "No .DS_Store in raw/",
+      check("error", "dsstore_clean", "No .DS_Store in raw/", "Cannot check \u2014 WIKI_PATH not resolved")
+    );
   }
-  const rawDir = join11(resolvedPath, "raw");
+  const rawDir = join12(resolvedPath, "raw");
   if (!existsSync8(rawDir)) {
     return check("pass", "dsstore_clean", "No .DS_Store in raw/", "raw/ directory not found \u2014 check skipped");
   }
@@ -1910,7 +2008,7 @@ function checkDotStoreClean(resolvedPath) {
       if (entry.name === ".DS_Store") {
         found.push(rel ? `${rel}/.DS_Store` : ".DS_Store");
       } else if (entry.isDirectory()) {
-        walk(join11(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name);
+        walk(join12(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name);
       }
     }
   })(rawDir, "");
@@ -1939,7 +2037,7 @@ function checkVaultConflictMarkers(resolvedPath) {
 }
 function githubSyncedGitRoot(gitRoot) {
   if (gitRoot === void 0) return { ok: false, reason: "No vault path \u2014 check skipped" };
-  if (!existsSync8(join11(gitRoot, ".git"))) return { ok: false, reason: "Not a git repository \u2014 check skipped" };
+  if (!existsSync8(join12(gitRoot, ".git"))) return { ok: false, reason: "Not a git repository \u2014 check skipped" };
   if (!git(gitRoot, ["remote"])) return { ok: false, reason: "No git remote \u2014 not GitHub-synced, check skipped" };
   return { ok: true, gitRoot };
 }
@@ -1949,7 +2047,7 @@ function checkVaultGitignoreHygiene(synced) {
   }
   let content = "";
   try {
-    content = readFileSync5(join11(synced.gitRoot, ".gitignore"), "utf8");
+    content = readFileSync5(join12(synced.gitRoot, ".gitignore"), "utf8");
   } catch {
     content = "";
   }
@@ -1987,7 +2085,7 @@ var hygieneProbe = {
   run(ctx) {
     const synced = githubSyncedGitRoot(ctx.gitCheckPath);
     return [
-      checkDotStoreClean(ctx.readOnlyScanRoot),
+      checkDotStoreClean(ctx.readOnlyScanRoot, ctx.mcpOnlyLeaf),
       checkVaultConflictMarkers(ctx.readOnlyScanRoot),
       checkVaultGitignoreHygiene(synced),
       checkTrackedHygieneScratch(synced)
@@ -1997,14 +2095,14 @@ var hygieneProbe = {
 
 // src/doctor/probes/s3-mount-health.ts
 import { existsSync as existsSync10 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 import { execSync as execSync4 } from "child_process";
 
 // src/utils/s3-mount-health.ts
 import { execSync as execSync3 } from "child_process";
 import { platform as platform2 } from "os";
 import { readFileSync as readFileSync6, writeFileSync as writeFileSync2, unlinkSync as unlinkSync2, readFileSync as readFile6 } from "fs";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 var OS = platform2();
 function findRcloneMountPid() {
   try {
@@ -2162,7 +2260,7 @@ function detectFuseMount(vaultPath) {
   return null;
 }
 function writeTest(dir) {
-  const testFile = join12(dir, `.doctor-write-test-${process.pid}.tmp`);
+  const testFile = join13(dir, `.doctor-write-test-${process.pid}.tmp`);
   const payload = `skillwiki doctor write test \u2014 ${Date.now()} \u2014 ${Math.random().toString(36).slice(2)}`;
   const start = Date.now();
   try {
@@ -2243,7 +2341,7 @@ function checkS3MountPerf(resolvedPath) {
     return check("pass", "s3_mount_perf", "S3 mount performance", "local disk");
   }
   const mountPoint = fuse.mountPoint;
-  const conceptsDir = join13(resolvedPath, "concepts");
+  const conceptsDir = join14(resolvedPath, "concepts");
   if (!existsSync10(conceptsDir)) {
     return check("pass", "s3_mount_perf", "S3 mount performance", `S3 FUSE mount (${mountPoint}), no concepts/ to benchmark`);
   }
@@ -2394,7 +2492,10 @@ function checkRcloneFlagAudit(resolvedPath) {
   }
   return check("pass", "rclone_flags", "rclone VFS flags", `PID ${pid}: all critical flags at safe values`);
 }
-function checkRcloneVersion(resolvedPath, vaultSyncInstalled, pushEnabled = true) {
+function checkRcloneVersion(resolvedPath, vaultSyncInstalled, pushEnabled = true, mcpOnlyLeaf = false) {
+  if (mcpOnlyLeaf) {
+    return check("pass", "rclone_version", "rclone version", "MCP-only leaf \u2014 rclone not required");
+  }
   const fuse = resolvedPath ? detectFuseMount(resolvedPath) : null;
   if (pushEnabled === false && !fuse) {
     return check("pass", "rclone_version", "rclone version", "push not required \u2014 check skipped");
@@ -2429,7 +2530,7 @@ function checkWriteTest(resolvedPath) {
   if (!fuse) {
     return check("pass", "s3_write_test", "S3 write test", "local disk \u2014 check skipped");
   }
-  const conceptsDir = join13(resolvedPath, "concepts");
+  const conceptsDir = join14(resolvedPath, "concepts");
   if (!existsSync10(conceptsDir)) {
     return check("pass", "s3_write_test", "S3 write test", "no concepts/ dir to test \u2014 check skipped");
   }
@@ -2521,7 +2622,7 @@ var s3MountHealthProbe = {
       checkS3MountPerf(ctx.resolvedPath),
       checkS3MountFreshness(ctx.resolvedPath),
       checkRcloneFlagAudit(ctx.resolvedPath),
-      checkRcloneVersion(ctx.resolvedPath, ctx.vsConfig.installed, ctx.vsConfig.pushEnabled !== false),
+      checkRcloneVersion(ctx.resolvedPath, ctx.vsConfig.installed, ctx.vsConfig.pushEnabled !== false, ctx.mcpOnlyLeaf),
       checkWriteTest(ctx.resolvedPath),
       checkVfsCacheHealth(ctx.resolvedPath)
     ];
@@ -2530,7 +2631,7 @@ var s3MountHealthProbe = {
 
 // src/doctor/probes/skills-plugins.ts
 import { existsSync as existsSync11, readdirSync as readdirSync4, readFileSync as readFileSync7 } from "fs";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 function findSkillMd(dir) {
   const results = [];
   let entries;
@@ -2541,9 +2642,9 @@ function findSkillMd(dir) {
   }
   for (const entry of entries) {
     if (entry.isFile() && entry.name === "SKILL.md") {
-      results.push(join14(dir, entry.name));
+      results.push(join15(dir, entry.name));
     } else if (entry.isDirectory()) {
-      results.push(...findSkillMd(join14(dir, entry.name)));
+      results.push(...findSkillMd(join15(dir, entry.name)));
     }
   }
   return results;
@@ -2557,18 +2658,18 @@ function findSkillNames(dir) {
     return results;
   }
   for (const entry of entries) {
-    if (entry.isDirectory() && existsSync11(join14(dir, entry.name, "SKILL.md"))) {
+    if (entry.isDirectory() && existsSync11(join15(dir, entry.name, "SKILL.md"))) {
       results.push(entry.name);
     }
   }
   return results;
 }
 function findInstalledSkillMd(dir) {
-  const directSkills = findSkillNames(dir).map((name) => join14(dir, name, "SKILL.md"));
+  const directSkills = findSkillNames(dir).map((name) => join15(dir, name, "SKILL.md"));
   return directSkills.length > 0 ? directSkills : findSkillMd(dir);
 }
 function checkSkillsInstalled(home, cwd) {
-  const srcDir = cwd ? join14(cwd, "packages", "skills") : void 0;
+  const srcDir = cwd ? join15(cwd, "packages", "skills") : void 0;
   if (srcDir && existsSync11(srcDir)) {
     const found = findInstalledSkillMd(srcDir);
     if (found.length > 0) {
@@ -2582,7 +2683,7 @@ function checkSkillsInstalled(home, cwd) {
       return check("pass", "skills_installed", "Skills installed", `${found.length} SKILL.md file(s) found (plugin v${plugin.version})`);
     }
   }
-  const skillsDir = join14(home, ".claude", "skills");
+  const skillsDir = join15(home, ".claude", "skills");
   if (existsSync11(skillsDir)) {
     const found = findInstalledSkillMd(skillsDir);
     if (found.length > 0) {
@@ -2593,10 +2694,10 @@ function checkSkillsInstalled(home, cwd) {
 }
 function checkDuplicateSkills(home) {
   const plugin = findPlugin(home);
-  const skillsDir = join14(home, ".claude", "skills");
+  const skillsDir = join15(home, ".claude", "skills");
   const agentSkillDirs = [
-    { label: "~/.codex/skills/", path: join14(home, ".codex", "skills") },
-    { label: "~/.agents/skills/", path: join14(home, ".agents", "skills") }
+    { label: "~/.codex/skills/", path: join15(home, ".codex", "skills") },
+    { label: "~/.agents/skills/", path: join15(home, ".agents", "skills") }
   ];
   if (!plugin) {
     return check("pass", "skills_duplicate", "Skills not duplicated", "Single install channel");
@@ -2629,10 +2730,10 @@ var STALE_GROK_ACTIVATION_REFERENCE = "Read @skillwiki.md";
 var ACTIVATION_FIX_HINT = "run `npm run install:activation` from the llm-wiki repo";
 function findGrokActivationTemplate(home, cwd) {
   if (cwd) {
-    const src = join14(cwd, "packages", "skills", "using-skillwiki", "activation.md");
+    const src = join15(cwd, "packages", "skills", "using-skillwiki", "activation.md");
     if (existsSync11(src)) return src;
   }
-  const pluginsRoot = join14(home, ".grok", "installed-plugins");
+  const pluginsRoot = join15(home, ".grok", "installed-plugins");
   if (!existsSync11(pluginsRoot)) return void 0;
   let entries;
   try {
@@ -2642,21 +2743,21 @@ function findGrokActivationTemplate(home, cwd) {
   }
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const root = join14(pluginsRoot, entry.name);
+    const root = join15(pluginsRoot, entry.name);
     for (const rel of ["using-skillwiki/activation.md", "skills/using-skillwiki/activation.md"]) {
-      const candidate = join14(root, rel);
+      const candidate = join15(root, rel);
       if (existsSync11(candidate)) return candidate;
     }
   }
   return void 0;
 }
 function checkGrokActivation(home, cwd) {
-  const grokDir = join14(home, ".grok");
+  const grokDir = join15(home, ".grok");
   if (!existsSync11(grokDir)) {
     return check("pass", "activation_grok", "Grok activation", "Not a Grok host");
   }
-  const activationPath = join14(grokDir, "skillwiki.md");
-  const agentsPath = join14(grokDir, "AGENTS.md");
+  const activationPath = join15(grokDir, "skillwiki.md");
+  const agentsPath = join15(grokDir, "AGENTS.md");
   const hasActivation = existsSync11(activationPath);
   const issues = [];
   if (!hasActivation) {
@@ -2771,7 +2872,7 @@ var skillsPluginsProbe = {
 
 // src/doctor/probes/vault-sync.ts
 import { existsSync as existsSync12, readFileSync as readFileSync8 } from "fs";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 import { execSync as execSync5 } from "child_process";
 import { platform as platform3 } from "os";
 function readPushResultState(stateFile) {
@@ -2800,7 +2901,7 @@ function readPushResultState(stateFile) {
 }
 function readVaultSyncConfig(home) {
   try {
-    const content = readFileSync8(join15(home, ".skillwiki", ".env"), "utf8");
+    const content = readFileSync8(join16(home, ".skillwiki", ".env"), "utf8");
     let installed = false;
     let role;
     let serviceScope;
@@ -3103,7 +3204,7 @@ function snapshotterHealthChecks(scope, logDir, env) {
   let completionOutcome = "unknown";
   const logRecords = fixture ? fixture.log_records : (() => {
     try {
-      const content = readFileSync8(join15(logDir, "wiki-snapshot.log"), "utf8");
+      const content = readFileSync8(join16(logDir, "wiki-snapshot.log"), "utf8");
       return content.split(/\r?\n/).filter(Boolean);
     } catch {
       return [];
@@ -3281,11 +3382,11 @@ function vaultSyncChecks(input) {
     ];
   }
   const isMac = os === "darwin";
-  const logDir = input.logDir ?? (isMac ? join15(home, "Library", "Logs") : join15(home, ".local", "state", "vault-sync", "log"));
-  const cacheDir = input.cacheDir ?? (isMac ? join15(home, "Library", "Caches", "vault-sync") : join15(home, ".cache", "vault-sync"));
-  const shareDir = input.shareDir ?? (isMac ? join15(home, "Library", "Application Support", "vault-sync", "bin") : join15(home, ".local", "share", "vault-sync", "bin"));
-  const filterPath = input.filterPath ?? join15(home, ".config", "rclone", "wiki-push-filters.txt");
-  const packagedSnapshotPath = join15(shareDir, "wiki-snapshot.sh");
+  const logDir = input.logDir ?? (isMac ? join16(home, "Library", "Logs") : join16(home, ".local", "state", "vault-sync", "log"));
+  const cacheDir = input.cacheDir ?? (isMac ? join16(home, "Library", "Caches", "vault-sync") : join16(home, ".cache", "vault-sync"));
+  const shareDir = input.shareDir ?? (isMac ? join16(home, "Library", "Application Support", "vault-sync", "bin") : join16(home, ".local", "share", "vault-sync", "bin"));
+  const filterPath = input.filterPath ?? join16(home, ".config", "rclone", "wiki-push-filters.txt");
+  const packagedSnapshotPath = join16(shareDir, "wiki-snapshot.sh");
   const legacySnapshotPath = "/root/.hermes/scripts/wiki-snapshot-v3.sh";
   const snapshotPath = input.snapshotScriptPath ?? (existsSync12(packagedSnapshotPath) ? packagedSnapshotPath : legacySnapshotPath);
   if (input.vaultSyncRole === "snapshotter") {
@@ -3342,9 +3443,9 @@ function vaultSyncChecks(input) {
     return [c12, ...healthChecks, cFetch2, c42, c52];
   }
   const env = input.env ?? process.env;
-  const fetchLogFile = join15(logDir, "wiki-fetch.log");
+  const fetchLogFile = join16(logDir, "wiki-fetch.log");
   if (input.pushEnabled === false) {
-    const fetchHelperPath = join15(shareDir, "wiki-fetch-notify.sh");
+    const fetchHelperPath = join16(shareDir, "wiki-fetch-notify.sh");
     const c12 = existsSync12(fetchHelperPath) ? check("pass", "vault_sync_installed", "Vault sync installed", `Found: ${fetchHelperPath}`) : check(
       "error",
       "vault_sync_installed",
@@ -3379,7 +3480,7 @@ function vaultSyncChecks(input) {
     );
     return [c12, c22, c32, cPushResult2, cFetch2, c42, c52];
   }
-  const pushScriptPath = join15(shareDir, "wiki-push.sh");
+  const pushScriptPath = join16(shareDir, "wiki-push.sh");
   const c1 = existsSync12(pushScriptPath) ? check("pass", "vault_sync_installed", "Vault sync installed", `Found: ${pushScriptPath}`) : check("error", "vault_sync_installed", "Vault sync installed", `Script not found at ${pushScriptPath} \u2014 run vault-sync-install`);
   let c2;
   try {
@@ -3431,9 +3532,9 @@ function vaultSyncChecks(input) {
       "Scheduler check failed \u2014 run vault-sync-install"
     );
   }
-  const stateFile = join15(cacheDir, "wiki-push-result.state");
+  const stateFile = join16(cacheDir, "wiki-push-result.state");
   const pushState = readPushResultState(stateFile);
-  const logFile = join15(logDir, "wiki-push.log");
+  const logFile = join16(logDir, "wiki-push.log");
   let c3;
   if (pushState.exists && !pushState.malformed && pushState.result === "refused") {
     const reasonSuffix = pushState.reason ? `: ${pushState.reason}` : "";
@@ -3583,7 +3684,7 @@ function checkVaultSyncPullHelper(home, env) {
   );
 }
 function isGitDir(path) {
-  return Boolean(path && existsSync12(join15(path, ".git")));
+  return Boolean(path && existsSync12(join16(path, ".git")));
 }
 function checkVaultSyncReviewRequiredJournals(ctx) {
   const live = ctx.resolvedPath;
@@ -3660,7 +3761,11 @@ var vaultSyncProbe = {
       snapshotScriptPath: ctx.vsConfig.snapshotScript,
       env: ctx.input.env ?? process.env
     }));
-    checks.push(checkVaultSyncPullHelper(ctx.input.home, ctx.input.env ?? process.env));
+    if (!ctx.vsConfig.installed) {
+      checks.push(check("pass", "vault_sync_pull_helper", "Vault-sync pull helper", "vault-sync not installed \u2014 check skipped"));
+    } else {
+      checks.push(checkVaultSyncPullHelper(ctx.input.home, ctx.input.env ?? process.env));
+    }
     checks.push(checkVaultSyncReviewRequiredJournals(ctx));
     checks.push(checkSnapshotWorktreeUnmerged(ctx));
     return checks;
@@ -3674,10 +3779,10 @@ import { platform as platform4 } from "os";
 
 // src/utils/satellite-run-health.ts
 import { existsSync as existsSync13, readFileSync as readFileSync9 } from "fs";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 var SATELLITE_STALE_MS = 26 * 60 * 60 * 1e3;
 function satelliteLatestRunPath(vault) {
-  return join16(vault, ".skillwiki", "agent-memory-trends", "latest-run.json");
+  return join17(vault, ".skillwiki", "agent-memory-trends", "latest-run.json");
 }
 function isFailedRunStatus(status) {
   return status === "fail" || status === "failure";
@@ -3813,7 +3918,7 @@ var satelliteProbe = {
 
 // src/doctor/probes/metrics.ts
 import { readFileSync as readFileSync10 } from "fs";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 var METRIC_TYPES = ["entities", "concepts", "comparisons", "queries", "meta"];
 function doctorReadOnlyScanRoot(resolvedPath) {
   return resolveReadOnlyVaultRoot(resolvedPath).root;
@@ -3857,7 +3962,7 @@ async function vaultMetrics(resolvedPath) {
   }
   let logLines = 0;
   try {
-    logLines = readFileSync10(join17(scanRoot, "log.md"), "utf8").split("\n").length;
+    logLines = readFileSync10(join18(scanRoot, "log.md"), "utf8").split("\n").length;
   } catch {
   }
   return [
@@ -3993,18 +4098,18 @@ var fuseStalenessProbe = {
 
 // src/doctor/probes/activation-marker.ts
 import { existsSync as existsSync15, readFileSync as readFileSync11, readdirSync as readdirSync5 } from "fs";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 var GROK_ACTIVATION_REFERENCE2 = "Read @~/.grok/skillwiki.md for SkillWiki activation context.";
 var STALE_GROK_ACTIVATION_REFERENCE2 = "Read @skillwiki.md";
 var ACTIVATION_FIX_HINT2 = "run `npm run install:activation` from the llm-wiki repo";
 function findGrokActivationTemplate2(home, cwd) {
   if (cwd) {
-    const src = join18(cwd, "packages", "skills", "using-skillwiki", "activation.md");
+    const src = join19(cwd, "packages", "skills", "using-skillwiki", "activation.md");
     if (existsSync15(src)) return src;
-    const directSrc = join18(cwd, "skills", "using-skillwiki", "activation.md");
+    const directSrc = join19(cwd, "skills", "using-skillwiki", "activation.md");
     if (existsSync15(directSrc)) return directSrc;
   }
-  const pluginsRoot = join18(home, ".grok", "installed-plugins");
+  const pluginsRoot = join19(home, ".grok", "installed-plugins");
   if (!existsSync15(pluginsRoot)) return void 0;
   let entries;
   try {
@@ -4014,21 +4119,21 @@ function findGrokActivationTemplate2(home, cwd) {
   }
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const root = join18(pluginsRoot, entry.name);
+    const root = join19(pluginsRoot, entry.name);
     for (const rel of ["using-skillwiki/activation.md", "skills/using-skillwiki/activation.md"]) {
-      const candidate = join18(root, rel);
+      const candidate = join19(root, rel);
       if (existsSync15(candidate)) return candidate;
     }
   }
   return void 0;
 }
 function checkActivationMarker(home, cwd) {
-  const grokDir = join18(home, ".grok");
+  const grokDir = join19(home, ".grok");
   if (!existsSync15(grokDir)) {
     return check("pass", "activation_marker", "Activation marker", "Not a Grok host \u2014 check skipped");
   }
-  const activationPath = join18(grokDir, "skillwiki.md");
-  const agentsPath = join18(grokDir, "AGENTS.md");
+  const activationPath = join19(grokDir, "skillwiki.md");
+  const agentsPath = join19(grokDir, "AGENTS.md");
   const hasActivation = existsSync15(activationPath);
   const issues = [];
   if (!hasActivation) {
@@ -4085,7 +4190,7 @@ var activationMarkerProbe = {
 
 // src/doctor/probes/ds-store-noise.ts
 import { existsSync as existsSync16, readdirSync as readdirSync6 } from "fs";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 var VAULT_TRACKED_DIRS = ["raw", "entities", "concepts", "comparisons", "queries", "meta", "_archive", "_Templates"];
 function checkDsStoreNoise(resolvedPath) {
   if (resolvedPath === void 0) {
@@ -4107,13 +4212,13 @@ function checkDsStoreNoise(resolvedPath) {
         found.push(rel ? `${rel}/.DS_Store` : ".DS_Store");
       } else if (entry.isDirectory()) {
         if (entry.name === ".git" || entry.name === "node_modules") continue;
-        walk(join19(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name);
+        walk(join20(dir, entry.name), rel ? `${rel}/${entry.name}` : entry.name);
       }
     }
   }
   let scannedAny = false;
   for (const sub of VAULT_TRACKED_DIRS) {
-    const subDir = join19(resolvedPath, sub);
+    const subDir = join20(resolvedPath, sub);
     if (existsSync16(subDir)) {
       scannedAny = true;
       walk(subDir, sub);
@@ -4143,17 +4248,14 @@ var dsStoreNoiseProbe = {
 
 // src/doctor/probes/mcp-handshake.ts
 import { existsSync as existsSync17 } from "fs";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 var DEFAULT_MCP_URL = "https://wiki.karldigi.dev/mcp";
-var URL_ENV = "SKILLWIKI_MCP_URL";
-var TOKEN_ENV = "SKILLWIKI_MCP_TOKEN";
 function mcpEnv(ctx) {
   return ctx.input.env ?? process.env;
 }
 function checkMcpUrl(ctx) {
-  const env = mcpEnv(ctx);
-  const override = env[URL_ENV];
-  if (typeof override === "string" && override.trim().length > 0) {
+  const creds = mcpAuthFromEnv(mcpEnv(ctx));
+  if (creds.url) {
     return check("pass", "mcp_url_configured", "HTTP MCP URL", "configured via env override");
   }
   return check(
@@ -4164,21 +4266,20 @@ function checkMcpUrl(ctx) {
   );
 }
 function checkMcpCredential(ctx) {
-  const env = mcpEnv(ctx);
-  const value = env[TOKEN_ENV];
-  if (typeof value === "string" && value.trim().length > 0) {
+  const creds = mcpAuthFromEnv(mcpEnv(ctx));
+  if (creds.token) {
     return check("pass", "mcp_credential_present", "HTTP MCP auth", "present");
   }
   return check(
     "warn",
     "mcp_credential_present",
     "HTTP MCP auth",
-    "not set \u2014 set in process env or host Configure (value not shown)"
+    "not set \u2014 set in process env, ~/.skillwiki/.env, or host Configure (value not shown)"
   );
 }
 function checkFrozenLeafWritePath(ctx) {
   const vault = ctx.resolvedPath;
-  if (!vault || !existsSync17(join20(vault, ".WIKI_GIT_FROZEN"))) {
+  if (!vault || !existsSync17(join21(vault, ".WIKI_GIT_FROZEN"))) {
     return check(
       "pass",
       "mcp_frozen_leaf_write_path",
@@ -4210,8 +4311,7 @@ function versionLessThan(a, b) {
   return pa.patch < pb.patch;
 }
 function redactSecret(detail, secret) {
-  if (!secret || secret.length === 0 || !detail.includes(secret)) return detail;
-  return detail.split(secret).join("[REDACTED]");
+  return redactMcpSecret(detail, secret);
 }
 function handshakeRow(status, detail, secret) {
   return check(status, HANDSHAKE_ID, HANDSHAKE_LABEL, redactSecret(detail, secret));
@@ -4269,9 +4369,10 @@ async function checkMcpHandshake(ctx) {
     return handshakeRow("pass", "not requested \u2014 check skipped");
   }
   const env = mcpEnv(ctx);
-  const url = typeof env[URL_ENV] === "string" && env[URL_ENV].trim().length > 0 ? env[URL_ENV].trim() : DEFAULT_MCP_URL;
-  const token = typeof env[TOKEN_ENV] === "string" ? env[TOKEN_ENV] : "";
-  if (token.trim().length === 0) {
+  const creds = mcpAuthFromEnv(env);
+  const url = creds.url ?? DEFAULT_MCP_URL;
+  const token = creds.token ?? "";
+  if (token.length === 0) {
     return handshakeRow("error", "auth not set \u2014 handshake not attempted (value not shown)");
   }
   const fetchFn = ctx.input.mcpFetch ?? globalThis.fetch;
@@ -4304,7 +4405,7 @@ async function checkMcpHandshake(ctx) {
       init.sessionId
     );
     const tools = toolNames(listed.result);
-    const frozen = Boolean(ctx.resolvedPath && existsSync17(join20(ctx.resolvedPath, ".WIKI_GIT_FROZEN")));
+    const frozen = Boolean(ctx.resolvedPath && existsSync17(join21(ctx.resolvedPath, ".WIKI_GIT_FROZEN")));
     if (frozen && !tools.includes(WORKITEM_TOOL)) {
       return handshakeRow(
         "error",
@@ -4377,6 +4478,10 @@ var DoctorRunner = class {
   async run(input) {
     const devSourceRun = isDevSourceRun(input.argv);
     const vsConfig = readVaultSyncConfig(input.home);
+    const baseEnv = input.env ?? process.env;
+    const mergedEnv = await mergeMcpAuthIntoEnv(input.home, baseEnv);
+    const auth = mcpAuthFromEnv(mergedEnv);
+    const inputWithEnv = { ...input, env: mergedEnv };
     const resolved = await resolveRuntimePath({
       flag: void 0,
       envValue: input.envValue,
@@ -4385,9 +4490,14 @@ var DoctorRunner = class {
     });
     const resolvedPath = resolved.ok ? resolved.data.path : void 0;
     const gitCheckPath = vsConfig.role === "snapshotter" ? resolveSnapshotGitWorktree(input.home) ?? resolvedPath : resolvedPath;
+    const mcpOnlyLeaf = isMcpOnlyLeaf({
+      resolvedPath,
+      token: auth.token,
+      vaultSyncInstalled: vsConfig.installed
+    });
     const fleetLoad = resolvedPath ? await loadFleetManifestAndHost({
       vault: resolvedPath,
-      env: { ...process.env, WIKI_PATH: input.envValue ?? resolvedPath },
+      env: { ...mergedEnv, WIKI_PATH: input.envValue ?? resolvedPath },
       home: input.home,
       cwd: input.cwd,
       osHostname: process.env.HOSTNAME,
@@ -4396,7 +4506,7 @@ var DoctorRunner = class {
     const satelliteGate = satelliteGateFromFleetLoad(fleetLoad);
     const readOnlyScanRoot = resolvedPath ? doctorReadOnlyScanRoot(resolvedPath) : void 0;
     const ctx = {
-      input,
+      input: inputWithEnv,
       devSourceRun,
       vsConfig,
       resolvedPath,
@@ -4404,13 +4514,18 @@ var DoctorRunner = class {
       gitCheckPath,
       fleetLoad,
       readOnlyScanRoot,
-      satelliteGate
+      satelliteGate,
+      mcpOnlyLeaf
     };
-    const checks = [];
+    const rawChecks = [];
     for (const probe of this.probes) {
       const probeChecks = await probe.run(ctx);
-      checks.push(...probeChecks);
+      rawChecks.push(...probeChecks);
     }
+    const checks = rawChecks.map((c) => ({
+      ...c,
+      detail: redactMcpSecret(c.detail, auth.token)
+    }));
     const summary = {
       pass: checks.filter((c) => c.status === "pass").length,
       info: checks.filter((c) => c.status === "info").length,
@@ -4429,7 +4544,7 @@ var DoctorRunner = class {
     if (summary.info > 0) summaryParts.push(`${summary.info} info`);
     summaryParts.push(`${summary.warn} warn`, `${summary.error} error`);
     lines.push(summaryParts.join(" \xB7 "));
-    const humanHint = lines.join("\n");
+    const humanHint = redactMcpSecret(lines.join("\n"), auth.token);
     return { exitCode, result: ok({ checks, summary, humanHint }) };
   }
 };
@@ -4461,7 +4576,7 @@ function readCliPackageJson(baseUrl = import.meta.url) {
 // src/utils/vault-write-gates.ts
 import { execFileSync } from "child_process";
 import { existsSync as existsSync19, readdirSync as readdirSync7, readFileSync as readFileSync13, statSync as statSync3 } from "fs";
-import { join as join21, relative as relative2 } from "path";
+import { join as join22, relative as relative2 } from "path";
 var DEFAULT_DIRTY_VOLUME_THRESHOLD = 50;
 var DEFAULT_CAPTURE_BUDGET = 20;
 var DEFAULT_NO_DECISION_STREAK = 3;
@@ -4517,7 +4632,7 @@ function isEventLedgerPath(rel) {
   return n === "meta/log-events" || n.startsWith("meta/log-events/");
 }
 function countEventLedgerFiles(vault) {
-  return listFilesRecursive(join21(vault, "meta", "log-events")).length;
+  return listFilesRecursive(join22(vault, "meta", "log-events")).length;
 }
 function measureDirtyVolume(vault) {
   const empty = (extra = {}) => ({
@@ -4577,7 +4692,7 @@ function measureDirtyVolume(vault) {
     if (!rel) continue;
     if (code === "??") {
       untracked += 1;
-      const abs = join21(vault, rel);
+      const abs = join22(vault, rel);
       if (existsSync19(abs) && statSync3(abs).isDirectory()) {
         const files = listFilesRecursive(abs);
         expanded += files.length;
@@ -4621,7 +4736,7 @@ function listFilesRecursive(dir) {
   }
   for (const name of entries) {
     if (name === ".git") continue;
-    const p = join21(dir, name);
+    const p = join22(dir, name);
     try {
       const st = statSync3(p);
       if (st.isDirectory()) out.push(...listFilesRecursive(p));
@@ -4752,7 +4867,7 @@ function listProjectDayCaptures(vault, project, day) {
       return;
     }
     for (const name of entries) {
-      const abs = join21(dir, name);
+      const abs = join22(dir, name);
       const rel = relBase ? `${relBase}/${name}` : name;
       try {
         const st = statSync3(abs);
@@ -4762,16 +4877,16 @@ function listProjectDayCaptures(vault, project, day) {
       }
     }
   };
-  walk(join21(vault, "raw", "transcripts"), "raw/transcripts");
-  walk(join21(vault, "projects", slug, "raw", "transcripts"), `projects/${slug}/raw/transcripts`);
-  walk(join21(vault, "projects", slug, "requirements"), `projects/${slug}/requirements`);
-  const workRoot = join21(vault, "projects", slug, "work");
+  walk(join22(vault, "raw", "transcripts"), "raw/transcripts");
+  walk(join22(vault, "projects", slug, "raw", "transcripts"), `projects/${slug}/raw/transcripts`);
+  walk(join22(vault, "projects", slug, "requirements"), `projects/${slug}/requirements`);
+  const workRoot = join22(vault, "projects", slug, "work");
   if (existsSync19(workRoot)) {
     try {
       for (const name of readdirSync7(workRoot)) {
         if (!name.startsWith(day)) continue;
         if (!/investigate|pilot-q|research|cycle|dev-loop/.test(name)) continue;
-        const abs = join21(workRoot, name);
+        const abs = join22(workRoot, name);
         if (statSync3(abs).isDirectory()) {
           for (const f of listFilesRecursive(abs)) {
             const rel = relative2(vault, f).replace(/\\/g, "/");
@@ -4877,7 +4992,7 @@ function runWritePreflight(input) {
 // src/commands/observe.ts
 import { mkdir as mkdir3, writeFile as writeFile2 } from "fs/promises";
 import { existsSync as existsSync20, statSync as statSync4 } from "fs";
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 import { createHash as createHash2 } from "crypto";
 var ALLOWED_KINDS = /* @__PURE__ */ new Set(["note", "bug", "task", "idea", "session-log"]);
 function slugify(text) {
@@ -4926,7 +5041,7 @@ async function runObserve(input) {
       };
     }
   }
-  const transcriptsDir = join22(input.vault, "raw", "transcripts");
+  const transcriptsDir = join23(input.vault, "raw", "transcripts");
   try {
     await mkdir3(transcriptsDir, { recursive: true });
   } catch {
@@ -4938,7 +5053,7 @@ async function runObserve(input) {
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const slug = slugify(input.text);
   const fileName = `${today}-observation-${slug}.md`;
-  const filePath = join22(transcriptsDir, fileName);
+  const filePath = join23(transcriptsDir, fileName);
   const body = `
 ${input.text.trim()}
 `;
@@ -4980,7 +5095,7 @@ ${input.text.trim()}
 // src/commands/memory.ts
 import { createHash as createHash3 } from "crypto";
 import { mkdir as mkdir4, readFile as readFile7, readdir as readdir2, stat as stat2, writeFile as writeFile3 } from "fs/promises";
-import { basename as basename2, extname, join as join23, relative as relative3, sep as sep2 } from "path";
+import { basename as basename2, extname, join as join24, relative as relative3, sep as sep2 } from "path";
 
 // src/utils/memory-authority.ts
 var TIER_RANK = {
@@ -5099,8 +5214,8 @@ async function runMemoryIndex(input) {
   }
   const generatedAt = (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z");
   const relCachePath = memoryCacheRelPath(input.project);
-  const absCachePath = join23(input.vault, relCachePath);
-  await mkdir4(join23(input.vault, ".skillwiki", "memory", input.project), { recursive: true });
+  const absCachePath = join24(input.vault, relCachePath);
+  await mkdir4(join24(input.vault, ".skillwiki", "memory", input.project), { recursive: true });
   await writeFile3(absCachePath, `${JSON.stringify({
     generated_at: generatedAt,
     project: input.project,
@@ -5292,7 +5407,7 @@ async function buildMemoryIndexState(pages, project) {
 }
 async function checkMemoryIndex(vault, project, current) {
   const relCachePath = memoryCacheRelPath(project);
-  const cacheText = await readIfExists(join23(vault, relCachePath));
+  const cacheText = await readIfExists(join24(vault, relCachePath));
   if (!cacheText) {
     return {
       ok: true,
@@ -5701,7 +5816,7 @@ async function walkImportFiles(dir, out) {
   const entries = await readdir2(dir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.name === ".git" || entry.name === "node_modules") continue;
-    const path = join23(dir, entry.name);
+    const path = join24(dir, entry.name);
     if (entry.isDirectory()) {
       await walkImportFiles(path, out);
     } else if (entry.isFile() && isImportCandidate(path)) {
@@ -5768,8 +5883,8 @@ async function writeImportCapture(vault, entry, today) {
   const content = hiddenString(entry, "__content");
   const project = hiddenString(entry, "__project");
   const relPath = await availableImportPath(vault, entry.proposed_path);
-  const absPath = join23(vault, relPath);
-  await mkdir4(join23(vault, "raw", "transcripts"), { recursive: true });
+  const absPath = join24(vault, relPath);
+  await mkdir4(join24(vault, "raw", "transcripts"), { recursive: true });
   await writeFile3(absPath, renderImportCapture(entry, content, project, today), "utf8");
   const validation = await runValidate({ file: absPath });
   return {
@@ -5785,7 +5900,7 @@ async function availableImportPath(vault, proposed) {
   const stem = proposed.slice(0, -ext.length);
   let candidate = proposed;
   let i = 2;
-  while (await readIfExists(join23(vault, candidate))) {
+  while (await readIfExists(join24(vault, candidate))) {
     candidate = `${stem}-${i}${ext}`;
     i++;
   }
@@ -5970,10 +6085,10 @@ function memoryCacheRelPath(project) {
 }
 async function readMemoryCache(vault, project) {
   if (project) {
-    const projectCache = await readIfExists(join23(vault, memoryCacheRelPath(project)));
+    const projectCache = await readIfExists(join24(vault, memoryCacheRelPath(project)));
     if (projectCache) return projectCache;
   }
-  return readIfExists(join23(vault, ".skillwiki", "memory-topics.json"));
+  return readIfExists(join24(vault, ".skillwiki", "memory-topics.json"));
 }
 function dedupePages(pages) {
   const seen = /* @__PURE__ */ new Set();
@@ -6065,7 +6180,7 @@ function slugify2(value) {
 
 // src/commands/query.ts
 import { readFile as readFile9, stat as stat4 } from "fs/promises";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 
 // src/utils/rrf.ts
 var RRF_K = 60;
@@ -6081,7 +6196,7 @@ function fuseRankings(lists, k = RRF_K) {
 
 // src/utils/vector-index.ts
 import { mkdir as mkdir5, readFile as readFile8, stat as stat3 } from "fs/promises";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 import { existsSync as existsSync21 } from "fs";
 var VECTOR_INDEX_REL = ".skillwiki/vectors/index.json";
 var VECTOR_INDEX_SCHEMA = "skillwiki-tfidf-index/v1";
@@ -6096,7 +6211,7 @@ function extractPageTokens(text) {
   return tokenize(`${title} ${body}`);
 }
 function vectorIndexPath(vault) {
-  return join24(vault, ...VECTOR_INDEX_REL.split("/"));
+  return join25(vault, ...VECTOR_INDEX_REL.split("/"));
 }
 function termFreq(tokens) {
   const tf = /* @__PURE__ */ new Map();
@@ -6151,7 +6266,7 @@ async function buildVectorIndex(vault, now = (/* @__PURE__ */ new Date()).toISOS
     docs
   };
   const dest = vectorIndexPath(vault);
-  await mkdir5(join24(vault, ".skillwiki", "vectors"), { recursive: true });
+  await mkdir5(join25(vault, ".skillwiki", "vectors"), { recursive: true });
   await atomicWriteText(dest, `${JSON.stringify(index)}
 `);
   return ok(index);
@@ -6194,7 +6309,7 @@ async function reindexPageInVectorIndex(vault, pageRelPath, now = (/* @__PURE__
   if (!normalizedPage.endsWith(".md")) {
     return err("USAGE", { message: `Page must be a .md file: ${pageRelPath}` });
   }
-  const absPath = join24(vault, ...normalizedPage.split("/"));
+  const absPath = join25(vault, ...normalizedPage.split("/"));
   let text;
   try {
     text = await readFile8(absPath, "utf8");
@@ -6279,7 +6394,7 @@ async function reindexPageInVectorIndex(vault, pageRelPath, now = (/* @__PURE__
     }
   }
   const dest = vectorIndexPath(vault);
-  await mkdir5(join24(vault, ".skillwiki", "vectors"), { recursive: true });
+  await mkdir5(join25(vault, ".skillwiki", "vectors"), { recursive: true });
   await atomicWriteText(dest, `${JSON.stringify(index)}
 `);
   return ok({
@@ -6297,7 +6412,7 @@ async function pruneVectorIndex(vault, opts) {
   const orphans = [];
   for (const docKey of Object.keys(index.docs)) {
     const normalizedKey = docKey.split(/\\|\//).join("/");
-    const absPath = join24(vault, ...normalizedKey.split("/"));
+    const absPath = join25(vault, ...normalizedKey.split("/"));
     if (!existsSync21(absPath)) {
       orphans.push(normalizedKey);
     }
@@ -6344,7 +6459,7 @@ async function pruneVectorIndex(vault, opts) {
       index.docs[docKey] = toTfIdf(termFreq(tokens), index.df, newPageCount);
     } else {
       try {
-        const text = await readFile8(join24(vault, ...docKey.split("/")), "utf8");
+        const text = await readFile8(join25(vault, ...docKey.split("/")), "utf8");
         const tokens = extractPageTokens(text);
         index.docs[docKey] = toTfIdf(termFreq(tokens), index.df, newPageCount);
       } catch {
@@ -6354,7 +6469,7 @@ async function pruneVectorIndex(vault, opts) {
   }
   if (!opts?.dryRun) {
     const dest = vectorIndexPath(vault);
-    await mkdir5(join24(vault, ".skillwiki", "vectors"), { recursive: true });
+    await mkdir5(join25(vault, ".skillwiki", "vectors"), { recursive: true });
     await atomicWriteText(dest, `${JSON.stringify(index)}
 `);
   }
@@ -6655,7 +6770,7 @@ function computeKeywordScore(terms, title, tags, body, relPath) {
   return score;
 }
 async function loadOrBuildGraph(vault) {
-  const graphPath = join25(vault, ".skillwiki", "graph.json");
+  const graphPath = join26(vault, ".skillwiki", "graph.json");
   let needsBuild = false;
   try {
     const fileStat = await stat4(graphPath);
@@ -6744,7 +6859,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod";
 
 // src/mcp/vault-resolve.ts
-import { join as join26, resolve as resolve4 } from "path";
+import { join as join27, resolve as resolve4 } from "path";
 
 // src/mcp/allowlist.ts
 import { resolve as resolve3, sep as sep3 } from "path";
@@ -6806,7 +6921,7 @@ async function resolveMcpVault(input) {
   return ok({ vault: vaultPath, source });
 }
 function defaultGraphOut(vault) {
-  return join26(vault, ".skillwiki", "graph.json");
+  return join27(vault, ".skillwiki", "graph.json");
 }
 
 // src/mcp/result-format.ts
@@ -6823,7 +6938,7 @@ function formatToolResult(payload) {
 // src/mcp/audit-log.ts
 import { appendFileSync, mkdirSync as mkdirSync2 } from "fs";
 import { homedir } from "os";
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 function auditEnabled() {
   const v = process.env.SKILLWIKI_MCP_AUDIT;
   if (v === "0" || v === "false") return false;
@@ -6835,7 +6950,7 @@ function auditSink() {
 function auditFilePath() {
   const custom = process.env.SKILLWIKI_MCP_AUDIT_FILE;
   if (custom && custom.length > 0) return custom;
-  return join27(homedir(), ".skillwiki", "mcp-audit.jsonl");
+  return join28(homedir(), ".skillwiki", "mcp-audit.jsonl");
 }
 function auditMcpToolCall(entry) {
   if (!auditEnabled()) return;
@@ -6845,7 +6960,7 @@ function auditMcpToolCall(entry) {
     return;
   }
   const path = auditFilePath();
-  mkdirSync2(join27(path, ".."), { recursive: true });
+  mkdirSync2(join28(path, ".."), { recursive: true });
   appendFileSync(path, line, "utf8");
 }
 async function runMcpToolHandler(tool, input, fn) {
@@ -7120,7 +7235,7 @@ function registerMcpMutatingTools(server) {
 
 // src/mcp/resources.ts
 import { readFile as readFile11 } from "fs/promises";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 
 // src/mcp/lint-bucket.ts
@@ -7250,7 +7365,7 @@ async function fetchQueryPreview(input) {
 
 // src/mcp/graph-html.ts
 import { readFile as readFile10 } from "fs/promises";
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 import { existsSync as existsSync22 } from "fs";
 var TYPE_COLORS = {
   entities: "#e74c3c",
@@ -7319,7 +7434,7 @@ ${nodeSvg}
   return { html, node_count: nodes.length, edge_count: edges.length, truncated };
 }
 async function fetchGraphHtmlReport(input) {
-  const graphPath = input.graphPath ?? join28(input.vault, ".skillwiki", "graph.json");
+  const graphPath = input.graphPath ?? join29(input.vault, ".skillwiki", "graph.json");
   const maxNodes = Math.min(Math.max(10, input.maxNodes ?? 120), 500);
   if (!existsSync22(graphPath)) {
     return {
@@ -7393,7 +7508,7 @@ async function fetchStaleSummary(input) {
 
 // src/mcp/resources.ts
 async function readVaultFile(vault, rel) {
-  return readFile11(join29(vault, rel), "utf8");
+  return readFile11(join30(vault, rel), "utf8");
 }
 async function tailLines(text, lines) {
   const parts = text.split(/\r?\n/);
@@ -7479,7 +7594,7 @@ function registerMcpResources(server) {
       if (!v.ok) {
         return { contents: [{ uri: uri.href, mimeType: "text/plain", text: JSON.stringify(v) }] };
       }
-      const path = join29(v.data.vault, ".skillwiki", "graph.json");
+      const path = join30(v.data.vault, ".skillwiki", "graph.json");
       try {
         const raw = await readFile11(path, "utf8");
         const graph = JSON.parse(raw);
@@ -7830,6 +7945,12 @@ export {
   renderProjectIndex,
   runProjectIndex,
   scanConflictMarkerBlocksInText,
+  MCP_URL_ENV,
+  MCP_TOKEN_ENV,
+  MCP_HOST_ID_ENV,
+  nonEmptyEnvValue,
+  mergeMcpAuthIntoEnv,
+  redactMcpSecret,
   configPath,
   runConfigGet,
   runConfigSet,
@@ -7844,6 +7965,7 @@ export {
   isFailedRunStatus,
   readSatelliteLatestRunFromText,
   evaluateSatelliteRunHealth,
+  DEFAULT_MCP_URL,
   runDoctor,
   readCliPackageJson,
   DEFAULT_DIRTY_VOLUME_THRESHOLD,